DMARC p=quarantine broke Friday payroll because the vendor's DKIM selector expired

Moved one payroll subdomain from p=none to p=quarantine after 30 days of clean DMARC reports. Friday morning, payslip emails started landing in quarantine because the vendor's custom DKIM selector had expired overnight.

SPF was passing, but not aligned. DKIM was the only aligned path, and the sender record in our inventory said "owned by HR" which apparently meant nobody owned it.

The vendor wanted us to roll DMARC back. HR wanted payroll out immediately. I ended up publishing a new selector and holding p=quarantine because rolling back the policy felt like teaching the wrong lesson.

My current rule is no p=quarantine or p=reject unless every production sender has a named business owner and a technical owner. Missing either one gets a deadline, then the sender gets treated as unsupported.

For people running DMARC across a pile of third-party senders, would you pause enforcement for payroll in that case, or force the ownership problem to get fixed under pressure?